chore: decompose net + bt doctor specs into build tasks, flip DOING

I ran spec-response Phase 6 on both READY specs. Each gets a SPEC_ID-bound parent task in todo.org with one child per implementation phase. Both specs flip from READY to DOING.

Only the read-only detection phases are buildable now, so they're marked solo: net Phase 0 (the control-plane probe) and bt Phases 0-1 (the two probes plus the firmware-hint Guide verdict). The privileged phases stay lower priority and carry a note: they're gated on the shared cross-panel run-time privilege model that doesn't exist yet. Shipping them before the Confirm floor would let --fix run root ops via passwordless sudo ungated.

I held off writing the manual-testing checklists. The phases that need live or reboot verification are the blocked ones, so their checklists would be planning work that can't start yet.

3 files changed, 34 insertions, 4 deletions

diff --git a/docs/specs/2026-07-11-bt-doctor-expansion-spec.org b/docs/specs/2026-07-11-bt-doctor-expansion-spec.org
index 77ee46d..b255b71 100644
--- a/docs/specs/2026-07-11-bt-doctor-expansion-spec.org
+++ b/docs/specs/2026-07-11-bt-doctor-expansion-spec.org
@@ -4,10 +4,11 @@
 #+TODO: TODO | DONE
 #+TODO: DRAFT READY DOING | IMPLEMENTED SUPERSEDED CANCELLED
 
-* READY Bt Doctor Expansion
+* DOING Bt Doctor Expansion
 :PROPERTIES:
 :ID:       3d4d61c4-e5df-44e9-b8e0-40b31452c3f7
 :END:
+- [2026-07-11 Sat @ 02:30 -0500] DOING — decomposed into build tasks (spec-response Phase 6); parent task in =todo.org= bound by =:SPEC_ID:=. Phases 0-1 (the two read-only probes + the firmware-hint Guide verdict) are buildable now and =:solo:=; Phase 2 (the persistent fix) is gated on the shared cross-panel privilege model.
 - [2026-07-11 Sat @ 02:00 -0500] READY — third skeptical re-review returned Ready with caveats, no blocking findings; all round-2 resolutions verified against the engine. Caveat accepted: Phase 2 (the persistent fix) depends on the shared cross-panel privilege model, which doesn't exist yet; Phase 0 (both read-only probes) and Phase 1 (the firmware-hint Guide) are buildable today.
 - [2026-07-11 Sat @ 01:45 -0500] DRAFT — round-2 review + response. A skeptical re-review caught a real blocker: the AutoEnable default is =true=, not =false= (verified, bluez 5.87), so round 1's "dead every boot on absent config" premise was backwards and would fire a false positive on healthy machines. Corrected — the fault fires only on explicit AutoEnable=false / disabled service / TLP. Also folded three non-blocking corrections (the =code= key is additive-not-existing; the INI-setter is real Phase 2 work; the sequencing caveat now actually in Risks). Findings =[8/8]=, decisions =[3/3]=. Awaiting a third re-review.
 - [2026-07-11 Sat @ 01:20 -0500] DRAFT — review incorporated (spec-response). All four findings dispositioned (=[4/4]=), all three decisions accepted and closed (=[3/3]=). The verdict-representation blocker resolved by defining a "verdict" as a step outcome in the existing status model.
@@ -18,7 +19,7 @@
 
 | Field    | Value                                                                             |
 |----------+-----------------------------------------------------------------------------------|
-| Status   | ready                                                                             |
+| Status   | doing                                                                             |
 |----------+-----------------------------------------------------------------------------------|
 | Owner    | Craig Jennings                                                                    |
 |----------+-----------------------------------------------------------------------------------|
diff --git a/docs/specs/2026-07-11-net-doctor-expansion-spec.org b/docs/specs/2026-07-11-net-doctor-expansion-spec.org
index b7867c1..0666dfe 100644
--- a/docs/specs/2026-07-11-net-doctor-expansion-spec.org
+++ b/docs/specs/2026-07-11-net-doctor-expansion-spec.org
@@ -4,10 +4,11 @@
 #+TODO: TODO | DONE
 #+TODO: DRAFT READY DOING | IMPLEMENTED SUPERSEDED CANCELLED
 
-* READY Net Doctor Expansion
+* DOING Net Doctor Expansion
 :PROPERTIES:
 :ID:       ce29b103-ed9d-4f56-bf8c-9ed8fe680ff3
 :END:
+- [2026-07-11 Sat @ 02:30 -0500] DOING — decomposed into build tasks (spec-response Phase 6); parent task in =todo.org= bound by =:SPEC_ID:=. Phase 0 (read-only control-plane probe) is buildable now and =:solo:=; Phases 1-2 are gated on the shared cross-panel privilege model. The systemic connection-name redaction gap is a separate filed task.
 - [2026-07-11 Sat @ 02:00 -0500] READY — third skeptical re-review returned Ready with caveats, no blocking findings; all round-2 resolutions verified against the engine. Caveat accepted: Phases 1-2 depend on the shared cross-panel run-time privilege model, which doesn't exist yet, so only Phase 0 (read-only detection) is buildable today. The redaction de-scope (parity + separate systemic task) is the one product call for Craig's eye.
 - [2026-07-11 Sat @ 01:45 -0500] DRAFT — round-2 review + response. A skeptical re-review caught two blockers the first round missed (one I introduced): the redaction "copy/--json surface" does not exist, and =rival-manager= as =needs-user-action= could never run its own fix. Both corrected — parity redaction + systemic gap filed separately; all three control-plane verdicts are =fixable=. Auth signal repointed at profile key-mgmt + scan security; masked-NM early-return path named. Findings =[9/9]=, decisions =[3/3]=. Awaiting a third re-review.
 - [2026-07-11 Sat @ 01:20 -0500] DRAFT — review incorporated (spec-response). All five findings dispositioned (=[5/5]=), all three decisions accepted and closed (=[3/3]=). Both cookies complete; awaiting a re-review to flip DRAFT → READY. Redaction blocker resolved (later found wrong in round 2).
@@ -18,7 +19,7 @@
 
 | Field    | Value                                                                             |
 |----------+-----------------------------------------------------------------------------------|
-| Status   | ready                                                                             |
+| Status   | doing                                                                             |
 |----------+-----------------------------------------------------------------------------------|
 | Owner    | Craig Jennings                                                                    |
 |----------+-----------------------------------------------------------------------------------|
diff --git a/todo.org b/todo.org
index dcc83e3..28338d1 100644
--- a/todo.org
+++ b/todo.org
@@ -26,6 +26,34 @@ The net doctor's copyable report (=report.py=, =scrub_text=) scrubs only MAC/IP,
 
 Split out of the 2026-07-11 net-doctor-expansion spec review: that spec's new rival-manager/keyfile-perms verdicts keep parity with this pre-existing behavior rather than half-solve it. Fix shape: extend redaction to cover the connection name + keyfile basename across the copyable report and =--json= (one systemic pass, not per-verdict), with a redaction test. Engine-wide, so it wants one coherent change rather than being bolted onto the expansion work.
 
+** TODO [#B] Net doctor expansion v1 — build the READY spec :feature:dotfiles:network:
+:PROPERTIES:
+:SPEC_ID: ce29b103-ed9d-4f56-bf8c-9ed8fe680ff3
+:END:
+Build the [[file:docs/specs/2026-07-11-net-doctor-expansion-spec.org][net doctor expansion]] (DOING). Adds the control-plane cluster (rival-manager / nm-masked / keyfile-perms) and a sharper auth verdict to the shipped net doctor (=~/.dotfiles/net/=). Archsetup owns the dotfiles work end to end — edit, test, commit, and push in =~/.dotfiles=, then drop an inbox note. Phases 1-2 are gated on the shared cross-panel run-time privilege model, which doesn't exist yet; Phase 0 builds now.
+*** TODO [#B] Phase 0 — control-plane probe (read-only) :solo:
+Pure engine, no classifier change. A probe reporting rival-manager state (=systemctl is-active= on dhcpcd/networkd/iwd scoped to the diagnosed link, not merely "is networkd running"), NM masked/failed/stopped (=is-enabled=), and active-profile keyfile permissions (=stat= under =/etc/NetworkManager/system-connections=) into the diag context. =net diag --json= shows the new signals. Tests: injected =systemctl is-active/is-enabled= results + a temp system-connections tree; every probe bounded with a timeout. Verify: =net diag --json= against fakes + =make test= green. Solo — buildable and verifiable with fakes.
+*** TODO [#C] Phase 1 — control-plane verdicts + privilege model
+Blocked on the shared cross-panel run-time privilege model. =classify= gains =rival-manager=/=nm-masked=/=keyfile-perms= (all =fixable=), ordered ahead of the generic not-running rule, with the masked check reachable in the NM-down early-return path. Fixes register as =VERBS= + =ACTIONS= (=disable-rival=/=unmask-nm=/=chmod-keyfile=), each narrowly scoped. Hard gate: must not land before the Confirm floor exists, or =net doctor --fix= runs root ops via passwordless sudo ungated. Live verification needs a real rival/masked/bad-keyfile state (a VM or a deliberately-broken host), so not solo.
+*** TODO [#C] Phase 2 — sharpened auth verdict
+Auth-reason classifier reading profile key-mgmt (=manage.py=) + scanned SECURITY (=nmcli.py=): SAE / hidden / enterprise / generic. SAE and hidden become =fixable= profile-modify (Confirm-tier); the rest stay =needs-user-action= with a cause-named message. Pairwise over (reason × profile-state). The classify logic is agent-buildable with fakes; the live profile-modify fix needs a real WPA3/hidden network to verify, so that part is manual.
+*** TODO [#C] Phase 3 — flip the net spec to IMPLEMENTED
+On v1 completion: flip the spec's status heading to IMPLEMENTED (dated history line + mirror) and log the vNext items (flaky/drops cluster, DoT/DNSSEC verdict, profile hygiene) to todo.org.
+
+** TODO [#B] Bt doctor expansion v1 — build the READY spec :feature:dotfiles:bluetooth:
+:PROPERTIES:
+:SPEC_ID: 3d4d61c4-e5df-44e9-b8e0-40b31452c3f7
+:END:
+Build the [[file:docs/specs/2026-07-11-bt-doctor-expansion-spec.org][bt doctor expansion]] (DOING). Adds a dmesg firmware-hint probe (names the missing blob on a no-adapter fault) and a boot-enablement probe (catches an adapter disabled at boot) to the shipped bt doctor (=~/.dotfiles/bluetooth/=). Phase 2 is gated on the shared cross-panel privilege model; Phases 0-1 build now. Archsetup owns the dotfiles work end to end.
+*** TODO [#B] Phase 0 — the two read-only probes :solo:
+Pure engine, no repair change. The dmesg firmware-hint reader (no-adapter branch, bounded =cmd.run(journalctl -k)= reusing the =doctor.py:84= precedent, per-vendor signature match) and the boot-enablement reader (AutoEnable from main.conf [Policy], =systemctl is-enabled=, TLP list). Both report into =diagnose()='s dict feeding the human summary + =--json=. Fault fires only on explicit AutoEnable=false / disabled service / TLP entry — bluez's default is true, so absent config is auto-enable-on and never a fault. Tests: canned journal buffer per vendor + injected main.conf/is-enabled/tlp states. Verify: fakes + =make test=. Solo.
+*** TODO [#B] Phase 1 — firmware-hint Guide verdict :solo:
+=diagnose= emits =no-adapter-firmware= (blob name in evidence, Reboot-tail Guide) on a signature match; falls back to the generic no-adapter otherwise. No auto-fix — a Guide, so no privilege dependency; lands independently of the shared model. The distinction rides existing =evidence=/=next_action= (no formatter change); an additive =schema.step= =code= key only if a machine identifier is wanted (locked test-contract ripple). Verify: fake journal fixtures + =make test=. Solo.
+*** TODO [#C] Phase 2 — persistent-power verdict + fix
+Blocked on the shared cross-panel privilege model. =powered-off-persistent= distinct from =powered-off=; the fix sets AutoEnable / enables the service / edits tlp, Privileged/Confirm. Needs an idempotent INI setter for main.conf ([Policy], preserve comments) and a list-edit for tlp.conf's =DEVICES_TO_DISABLE_ON_STARTUP= — real work, not argv one-liners. Hard gate: no Privileged fix before the Confirm floor. Persistence only proves out across a real reboot, so verification is manual.
+*** TODO [#C] Phase 3 — flip the bt spec to IMPLEMENTED
+On v1 completion: flip the spec's status heading to IMPLEMENTED (dated history line + mirror) and log the vNext items (stale-bond signature, connection-parameter hints, bt-audio-profile expansion) to todo.org.
+
 ** TODO [#D] Maintenance console vNext :feature:
 Deferred from the [[file:docs/specs/2026-07-07-maintenance-console-spec.org][spec]] (v1 ships determinate remedies only): AI/workflow assistance on read-only metrics (the vLater tier — failed-unit diagnosis, journal-error fix suggestions, OOM investigation); SIGKILL escalation for TERM-survivors on the KILL lever; live streaming meters on evidence rows where a count could be a level.